What is the CVSS score of CVE-2026-27306?

CVE-2026-27306 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Coldfusion are affected by CVE-2026-27306?

Adobe ColdFusion versions 2023.18, 2025.6 and earlier contain an arbitrary code execution vulnerability (CVSS 8.4) affecting authenticated high-privilege users who open malicious files.

How to fix or mitigate CVE-2026-27306?

Within 24 hours: Identify all ColdFusion 2023.18 and 2025.6 instances in your environment and document users with high-privilege accounts. Within 7 days: Implement file upload restrictions and disable unnecessary features on affected servers; restrict high-privilege user access to least-privilege principles; enable ColdFusion security sandboxing if available. Within 30 days: Monitor vendor advisories for patch availability; evaluate migration timeline to patched ColdFusion versions; conduct user awareness training on malicious file handling; implement file validation controls for ColdFusion-processed uploads.

Coldfusion CVE-2026-27306

EUVD-2026-22734 HIGH

Improper Input Validation (CWE-20)

2026-04-14 psirt@adobe.com

RCE Coldfusion

8.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.4 HIGH

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 22:40 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22734

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

HIGH 8.4

DescriptionCVE.org

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Attacker requires elevated privileges. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2023.18, 2025.6 and earlier allows authenticated attackers with high privileges to execute malicious code through improper input validation. Exploitation requires user interaction (victim opening a malicious file). EPSS data not available; no confirmed active exploitation (not in CISA KEV). CVSS 8.4 reflects high impact across confidentiality, integrity, and availability with scope change, though real-world risk is constrained by requiring both elevated privileges and user interaction.

Technical ContextAI

Adobe ColdFusion is a commercial rapid web application development platform. This vulnerability (CWE-20: Improper Input Validation) stems from insufficient validation of input data, allowing specially crafted files to bypass security controls and execute arbitrary code when processed by the application. The CVSS vector indicates Adjacent Network attack vector (AV:A), meaning the attacker must be on the same network segment as the target. The Scope change (S:C) indicates the vulnerability can affect resources beyond its security scope, suggesting potential container escape or privilege escalation beyond the immediate ColdFusion process context. The combination of improper input validation and file processing suggests the flaw may exist in ColdFusion's file upload, template processing, or administrative interface components.

RemediationAI

Apply Adobe's security updates immediately by upgrading to the patched versions specified in APSB26-38. For ColdFusion 2023, upgrade to the version newer than 2023.18 as specified in the bulletin. For ColdFusion 2025, upgrade to the version newer than 2025.6 as specified in the bulletin. Download patches from Adobe's official distribution channels. As interim risk reduction measures: restrict administrative access to ColdFusion to trusted networks only, implement strict file upload validation at network perimeter, educate privileged users about risks of opening untrusted files in ColdFusion context, and monitor administrative sessions for suspicious file processing activity. Full remediation guidance is available at https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html.